Supplier risk tier calculator

Six questions about spend, criticality, data, alternatives, regulation and integration give a suggested tier and the checks to match.

Answer six questions about one supplier to get a suggested tier, from T1 Strategic partner to T4 Transactional supplier, and the checks that usually come with it. It uses the same scoring as the tier assessment in SupplierVault. Nothing you choose leaves your browser.

1. How much do you spend with them each year? Under £10,000 £10,000 to £49,999 £50,000 to £249,999 £250,000 or more

2. Business criticality: what happens if they fail? Little impact Disruption we could work around Essential operations stop

3. What data of yours can they access? None Internal or operational data Personal data Sensitive or special category data, or customer data in bulk

4. How easy would they be to replace? Many alternatives, easy to switch A few alternatives, switching takes months Very few or none

5. Regulatory relevance: are rules involved? None Some (contract terms or sector rules) High (a regulated activity, such as FCA outsourcing)

6. How connected are they to your systems and processes? Stand-alone Connected to some of our processes or systems Deeply integrated

Answer all six questions to see the suggested tier.

How the tier is worked out

Each answer scores points, up to 18 in total:

Question	Points
Annual spend	Under £10,000: 0 · £10,000 or more: 1 · £50,000 or more: 2 · £250,000 or more: 3
Business criticality	Low: 0 · Medium: 2 · High: 4
Data access	None: 0 · Internal: 1 · Personal: 2 · Sensitive: 3
Alternatives	Many: 0 · A few: 1 · Very few or none: 3
Regulatory relevance	None: 0 · Some: 1 · High: 3
Integration	Stand-alone: 0 · Connected: 1 · Deeply integrated: 2

T1 Strategic partner if the total is 11 or more, or criticality is high and there are very few alternatives or spend is £250,000 or more.
T2 Key supplier if the total is 6 or more, or criticality is high, or they can access sensitive data, or regulatory relevance is high.
T3 Approved supplier if the total is 2 or more.
T4 Transactional supplier otherwise.

Sensitive data and high regulatory relevance each put a supplier in at least T2, whatever it costs. A small payroll bureau holding every employee's bank details needs more oversight than its spend suggests.

The tier is a starting point, not a rule. Your own policy, a regulator or an auditor may expect more for some suppliers. Keep the tier (how closely you manage the supplier) separate from the risk rating (what could go wrong). Read more in our guides to supplier tiering and third-party risk management.

SupplierVault does this on every supplier record. The tier assessment fills in answers from the intake form where it can, suggests a tier with its reasons, flags suppliers that should move up or down and creates the onboarding checks for the tier.

Try the live demo

GuideSupplier tieringTiering lets you spend your time on the suppliers that matter most, and keep the rest simple.GuideThird-party risk managementA proportionate approach that a small team can keep running, not a framework that sits on a shelf.TemplateSupplier due diligence questionnaireQuestions to send suppliers, grouped by topic, with a guide to which sections each tier needs.

Supplier risk tier calculator

How the tier is worked out

Related